September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55317 In printf of printf.c, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55332 In multiple locations, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55365 In multiple functions of remap.c, there is a possible out-of-bounds write due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56879 In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56888 In multiple locations, there is a possible permission bypass due to side channel... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56889 In multiple locations, there is a possible permission bypass due to an integer o... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56892 In ReadDataElement of common.c, there is a possible information disclosure due t... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56907 In VPU, there is a possible shared memory overwrite due to improper input valida... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56964 In multiple locations, there is a possible use-after-free due to a race conditio... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56958 In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds... |
medium | 5.5 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56950 In validate_ns_buf of mbu_class.rs, there is a possible information disclosure d... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56932 In Trusted Execution Environment, there is a possible memory corruption due to i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56923 In handle_unmap_req of tipc_virtio_dev.c, there is a possible memory corruption... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56922 In CPM, there is a possible permission bypass due to a confused deputy. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56915 In bigo_worker_thread of bigo.c, there is a possible escalation of privilege due... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-91742 Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.... |
medium | 4.8 | — | Google / chrome | 2026-09-15 | 2026-09-21 |
| CVE-2026-93376 Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allow... |
medium | 6.3 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-56988 In multiple functions of bluetooth_cco.cc, there is a possible use-after-free du... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56972 In multiple locations, there is a possible out-of-bounds write due to an incorre... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56973 In multiple locations, there is a possible escalation of privilege due to a logi... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56975 In Cellular Modem, there is a possible denial of service due to improper input v... |
medium | 6.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56979 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57006 In acfw_ffa.c, there is a possible secret read due to a logic error in the code. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56989 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56992 In multiple files, there is a possible permission bypass due to a confused deput... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57035 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57042 In multiple functions of DreamPickerReceiver.kt, there is a possible permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-93383 Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93385 Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remo... |
medium | 6.5 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93386 UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 a... |
medium | 5.4 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93387 Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-58698 In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission byp... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58716 In multiple locations, there is a possible time-of-check to time-of-use due to a... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58773 In link_load_gnss_image of link_device.c, there is a possible out-of-bounds writ... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58767 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58765 In GPU, there is a possible permission bypass due to a logic error in the code. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58755 In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of p... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58751 In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due t... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58747 In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due t... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58739 In platform_msg_handler_init of default_msg_handlers.c, there is a possible conf... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.